Most tools stop at an alert. Michael closes the loop: it sees the event, chooses a response inside your policy, performs it, and writes the evidence to a chain you can verify.
The same loop runs for a package finding, a web attack, or a suspicious AI-agent egress event.
The agent reads packages, services, runtime signals, and web requests. It records what it can actually see, not what a feed says might exist.
inventory + telemetryA deterministic score combines exposure, exploitability, impact, and match confidence. Typed models cover the common cases; an LLM is used only for ambiguity.
priority = f(exposure, impact)Inside the policy, Michael applies the smallest reversible action: virtual patch, quarantine, session revoke, or a request for approval.
simulated by defaultEvery mutation is an action with a mode, a rollback path, and an audit entry. The chain is keyed with an HMAC stored beside the database.
SHA-256 + HMAC chainMost events never reach a large model. That is how deep protection stays affordable on a $5 VPS.
Known-bad signatures, package versions, and policy gates. Instant, free, and explainable.
What normal looks like on this workload: processes, egress, login hours, request shape.
Chooses the response and explains the trade-off for about $0.0001 per decision.
Only for genuinely ambiguous evidence. It writes the narrative; it does not get the keys.
If you can run one command in a build step or a cron job, you are covered. No inbound ports, no host login, no agent to babysit.
Wrap the handler or mount the middleware. Rules are fetched once and enforced in-process.
curl -fsSL $BASE/app/install/TOKEN.sh | sh
A drop-in guard through auto_prepend_file, plus a cron report. No network call on the request path.
curl -fsSL $BASE/app/install/TOKEN.sh | sh
WSGI middleware with the same policy client and the same audit trail.
curl -fsSL $BASE/app/install/TOKEN.sh | sh
A deliberately vulnerable PHP portal runs on loopback on the live host. Michael probes it over TCP, records real findings, applies a data-only virtual patch, and blocks the exploit through a separate proxy. The application underneath is never patched in this demo — that is the point.
| Vector | Direct to the app | Through the shield | What Michael records |
|---|---|---|---|
| SQL injectionLAB-2026-SQLI | 302 accepted | 403 blocked | Blocked by Michael · audit entry |
| Command injectionLAB-2026-CMDI | marker executed | 403 blocked | Blocked by Michael · audit entry |
| Path traversalLAB-2026-TRAVERSAL | login source | 403 blocked | Blocked by Michael · audit entry |
| Oversized body300 KB cap | accepted | 413 blocked | body_cap · audit entry |
No card. No host login. It is the same engine that runs the paid fleet, scoped to the apps you cannot SSH into.
Michael reads the resolved versions your app reports and matches them against OSV for the ecosystem you actually use.
no guessed versionsWhen an advisory has a signature, the control plane publishes a rule. The SDK enforces it on the next request and revokes it when you upgrade.
rules are dataA malicious or compromised release becomes a deny rule, so the process refuses to start with it installed.
deny_packageFor the people who need protection most and can afford it least. Start on an app for free, then add servers when you have them.